The present disclosure relates generally to information handling systems, and more particularly to a method and apparatus for detection of malicious computer code in the form of a Trojan horse in an information handling system.
Trojan Horses (“Trojans”) are a particular type of malicious code. Malicious code is code that executes on an information handling system, typically a computer, but it can also be a Personal Digital Assistant or other information handling device, and is intended to damage the computer, alter the computer without the permission of the computer's user, or use the computer against the wishes of the computer's user. The Trojan horse is executable code that can exist in one of many forms. For example, some but not all of the forms that Trojans can be instantiated in executable code are as one or more programs, threads inside other programs, plugins or shared modules loaded by other programs, or modules loaded into operating system kernel memory in the manner of a device driver or loadable kernel module. A Trojan is a form of malicious code that enables a person to remotely control someone else's computer. The person who remotely controls the computer is known as the “Evil Hacker” while the person whose computer is being remotely controlled is known as the “Innocent Victim”. BackOrifice 2000, SubSeven, NetBus and OptixPro are all examples of Trojans. Trojans are sometimes referred to as “back-doors” or “hacker back-doors.”
Most Trojans have two components, the client program (Trojan Client) that is run on the Evil Hacker's computer and the server program (Trojan Server) that is run on the Innocent Victim's computer. Some Trojans have only a Trojan Server that can be remotely controlled through manually entered commands rather than through the programmatic interface of a Trojan Client.
Trojans can be used by Evil Hackers to disrupt the normal operation of the Innocent Victim's computer, to spy on the Innocent Victim, to steal money from the Innocent Victim, or to steal intellectual property from the Innocent Victim. The Evil Hacker often uses the Innocent Victim's computer to perform these malicious activities in order to harm the organization to which the Innocent Victim belongs. Trojans can thus harm computer systems, whether or not the particular computer systems belong to an individual, a company, organization, or government.
There are many ways to infect a computer with a Trojan including sending the Innocent Victim the Trojan Server disguised as a valid program, copying the Trojan Server onto the Innocent Victim's computer, or exploiting a vulnerability in the Innocent Victim's computer to place the Trojan Server on the computer.
Several techniques exist that are effective for detecting some forms of malicious code. For example, some types of malicious code can be detected by examining the binary code image of the running program or the binary image of the program when it is stored on a storage device. Many malicious code programs can be identified by a unique bit or byte pattern. The unique bit or byte pattern can comprise the entire image of the program while it is in memory or while it is stored on disk. The signature can also be a bit or byte pattern that is a portion of the program in memory or on disk. Once the unique sequence has been identified, a signature can be developed to identify the sequence. The signature is often the bit or byte pattern itself or it is in the form of a checksum. A detection program can then search for a malicious code program using the signature to identify the unique bit or byte sequence. Trojans, however, can be configured so that they have no easily identifiable signature. Trojans have configuration parameters that change the bit or byte sequences in the program and make it difficult or impossible to provide a unique signature. There are many tools available that can be used to reconfigure a Trojan so that it will not have a known signature.
Another technique used to identify malicious code examines the behavior of a Trojan Server while the Trojan Server is loaded and installed on a computer. With such a technique, a loaded and installed program is first placed into a Sandbox. The Sandbox comprises a restricted area on the computer where the program (e.g., Trojan Server) can be examined safely. While such an approach may be effective for preventing some Trojan infection, the approach does not however detect Trojan Servers once they are already installed on a computer. Such an approach does not detect many Trojan Servers because Trojans do not exhibit their most characteristic behaviors while they are being loaded or installed, but rather they come alive and exhibit their malicious behavior after they have been loaded and installed.
Accordingly, it would be desirable to provide an improved method for detecting Trojans in a computer system and overcoming problems in the art discussed above.